Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some discouraging anecdotes on how services handle account deletions

ctrl.blog

Post reply on HN
Print view View original

81–90 of 133 posts

Re: Some discouraging anecdotes on how services handle account deletions

#81

Post by Xylakant »

Nextgrid wrote: post #49
EdwardDiego wrote: post #45

Earlier quoted context omitted.

How do you mean?

Let’s imagine you’re a modern bank and associate card transactions with the merchant. Even if you sanitize/delete the account holder record, you can’t delete the transactions themselves (as it would screw up your accounting) nor the merchant association. Now let’s say you have a very particular customer that always goes to a very specific restaurant at pretty much the same time every day consistently. That pattern al…

A bank would entirely be entitled to keep the info around. All information that must be retained by law (such as receipts, financial transactions etc.) is exempt from the GDPR and you cannot ask for deletion. You can ask that the holder of that information does not use it for purposes other than the ones covered by law, but that’s the full extend of it.

Re: Some discouraging anecdotes on how services handle account deletions

#82

Post by koblas »

Nextgrid wrote: post #49
EdwardDiego wrote: post #45

Earlier quoted context omitted.

How do you mean?

Let’s imagine you’re a modern bank and associate card transactions with the merchant. Even if you sanitize/delete the account holder record, you can’t delete the transactions themselves (as it would screw up your accounting) nor the merchant association. Now let’s say you have a very particular customer that always goes to a very specific restaurant at pretty much the same time every day consistently. That pattern al…

Banks are also regulated by financial crime regulations, which take presence over GDPR. There is an obligation to preserve data for a period of time (years) for this purpose.

Re: Some discouraging anecdotes on how services handle account deletions

#83

Post by Allypost »

dschuetz wrote: post #61

Is it possible in Germany to file a GDPR violation against vendors who outright refuse deletion or fail to comply otherwise?

I'm pretty sure you can file a complaint with any company that operates in Germany (or other GDPR-supporting countries). AFAIK it does not matter where they're registered, only that they provide services in your country.

Re: Some discouraging anecdotes on how services handle account deletions

#84

Post by dschuetz »

Allypost wrote: post #83
dschuetz wrote: post #61

Is it possible in Germany to file a GDPR violation against vendors who outright refuse deletion or fail to comply otherwise?

I'm pretty sure you can file a complaint with any company that operates in Germany (or other GDPR-supporting countries). AFAIK it does not matter where they're registered, only that they provide services in your country.

I wonder if I can automate this...

Re: Some discouraging anecdotes on how services handle account deletions

#85

Post by endominus »

teddyh wrote: post #74
andrei_says_ wrote: post #71

Earlier quoted context omitted.

How does the law relate to backups? What about reports run in the past and possibly saved on someone’s local drive?

https://gdpr-info.eu/

Just linking to the root of the documentation itself doesn't help much. The relevant info appears to be Article 17, but even it makes no explicit mention of backups. There is this line, though; "[T]he controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data." This is not clarified in Article 23, Restrictions, so the logical meaning would be that even backups - assuming they are not read-only which would make this, at least in the minds of people who understand the technical limitation, unreasonable - must be purged of user data on an account deletion request. However, "reasonable to people who understand the technology" is not synonymous with "reasonable to people who make/enforce the law."

Re: Some discouraging anecdotes on how services handle account deletions

#86

Post by ghusbands »

Bombthecat wrote: post #79
organsnyder wrote: post #30

Earlier quoted context omitted.

That's illegal under the GDPR and many other privacy laws and is subject to heavy fines if caught. I work in privacy at a large tech company, and we take this stuff extremely seriously.

No one really checks Source : talked with people who implemented gdpr deletion at some companies.

So you're suggesting it's okay to ignore the law if the enforcement isn't complete? It's designed to protect people from corporate overreach.

Also, given that the EU has been taking increasing action against companies for non-compliance, I wouldn't bet on it remaining unchecked forever. In the intermediate term, I'd bet on there being third-party compliance checks and certificates, with companies that don't use such getting more attention.

Re: Some discouraging anecdotes on how services handle account deletions

#87

Post by efdee »

danielskogly wrote: post #77
itvision wrote: post #6

I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.

When a user requests deletion from my wishlist service, I fully delete everything, not only to be GDPR-compliant, but because it's the right thing to do. This includes: - Their account changes and passports - Their own wishlists, including all items added - Any claims they've made on other wishlists - Any item suggestions they've added to other wishlists - The checked status of any item suggestions they've checked on…

But that's the easy part. What about your backups?

Re: Some discouraging anecdotes on how services handle account deletions

#88

Post by barrkel »

michaelt wrote: post #73
SheinhardtWigCo wrote: post #62

Earlier quoted context omitted.

Is this based on your interpretation of GDPR, or legal precedent?

Given that 99% of GDPR stuff goes unenforced, presumably it's the former. If you understand the GDPR exclusively based on legal precedent, you'd probably conclude the GDPR doesn't exist.

GDPR creates a legal liability. It's less about enforcement and more about litigation risk.

Re: Some discouraging anecdotes on how services handle account deletions

#89

Post by DelightOne »

Nextgrid wrote: post #35
organsnyder wrote: post #30

Earlier quoted context omitted.

That's illegal under the GDPR and many other privacy laws and is subject to heavy fines if caught. I work in privacy at a large tech company, and we take this stuff extremely seriously.

The heavy fines everyone is fear-no getting about are a running joke now. It took 4 years and a non-profit making lots of noise for a brazen, obvious and malicious GDPR breach to be investigated despite it being plastered on every single website out there (I’m talking about non-compliant consent popups). To date, the accumulated fine amount over the 4 years and all fined companies is around a billion. Now lookup the…

When the enforcing agency works against it, its harder to effect change. Do many companies change their ways due to GDPR though? Not having too many fines may also be a testament to compliance kicking in before fines are necessary.

I think the system improved the web as a whole for EU with new options for consumers despite.

Re: Some discouraging anecdotes on how services handle account deletions

#90

Post by aneeshnl »

osener wrote: post #75

I wonder how this is supposed to work with workplace apps such as Slack, especially with regards to GDPR. Say I am leaving my job, and want my personal information to be purged from this 3rd party service (Slack). They say [1] "Primary Owners of a workspace or org must contact Slack to request deletion of a deactivated member's profile information." . What if I contact the "Primary Owner" before leaving my job and th…

If you are using company account, company owns the data. The data produced during company time is company's property. Company has to request for deletion. Slack is right about it.
Post reply on HN